Bourne Community Radio | Independent Local Radio Lincs.

Bourne Community Radio Confidentiality & Data Protection Policy Statement

Bourne Community Radio is required to process relevant personal data regarding its members, volunteers, partners, stakeholders, clients and customers as part of its operation and shall take all reasonable steps to do so in accordance with this Policy.

Bourne Community Radio has access to information concerning many groups and individuals and it is therefore imperative that appropriate confidentiality is maintained at all times.

Information entrusted to members of Bourne Community Radio must be treated appropriately and confidentially. Any information passed outside Bourne Community Radio will only be disclosed where the person or body concerned has given appropriate permission, or where disclosure is otherwise lawful, necessary or required by law.

Responsibility

Bourne Community Radio has a responsibility to ensure all its members and volunteers are aware of the data protection principles and the need for confidentiality, and that they are aware of specific guidelines that may be developed for specialised areas of work.

All members of Bourne Community Radio and volunteers are responsible for ensuring any information they hold or are party to is handled in line with Bourne Community Radio policies, the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018 and relevant provisions of the Data (Use and Access) Act 2025.

A failure to handle personal information appropriately may constitute a breach of data protection legislation and/or this Policy. A serious breach may be treated as a disciplinary matter and, depending on the circumstances, may also need to be reported to the Information Commissioner's Office (ICO) and/or affected individuals.

Care With Identification

It is accepted that many breaches of confidentiality are accidental rather than deliberate and it is important to remember not to break confidentiality regardless of how information is received.

It is important to recognise that descriptions of individual events and circumstances can lead to identification even when names have not been used.

Members and volunteers should therefore consider whether an individual could be identified directly or indirectly before sharing information.

Discussions

It is accepted that on certain occasions you may need to discuss an issue with other members, for example the Chair.

Where this occurs, information should only be shared with people who have a legitimate need to know it. All people concerned must understand that confidential matters must not be discussed outside Bourne Community Radio unless disclosure is authorised, necessary and lawful.

Exceptional Circumstances

Bourne Community Radio recognises that on rare occasions it may be necessary to disclose information that would normally remain confidential.

For example, safeguarding situations concerning danger or potential danger to children, young people or vulnerable adults may require information to be disclosed.

Where a member or volunteer feels that a matter is sufficiently serious, they should report it to the Chair or the appropriate safeguarding lead as soon as possible.

The appropriate person will decide what action should be taken in accordance with Bourne Community Radio policies and applicable law. Depending on the nature and urgency of the issue, it may also be appropriate to consult the Vice-Chair, Secretary, safeguarding lead, emergency services, local authority or another relevant body.

Nothing in this Policy prevents a person from contacting the emergency services or another appropriate authority directly where there is an immediate risk of serious harm.

Data Protection Controller

For the purposes of UK data protection law, Bourne Community Radio is the Data Controller where it determines the purposes and means for which personal information is processed.

Responsibility for overseeing data protection compliance may be delegated to appropriate members or officers of Bourne Community Radio.

The Data Protection Officer/Data Protection Lead will assist Bourne Community Radio in ensuring that personal information is processed in compliance with this Policy, the UK GDPR, Data Protection Act 2018 and Data (Use and Access) Act 2025.

The Principles

Bourne Community Radio shall comply with the data protection principles contained in the UK GDPR and associated UK data protection legislation.

Personal data shall be:

Processed lawfully, fairly and transparently
Collected for specified, explicit and legitimate purposes
Adequate, relevant and limited to what is necessary
Accurate and, where necessary, kept up to date
Kept for no longer than is necessary for the purposes for which it is processed
Processed in a manner that ensures appropriate security
Protected against unauthorised or unlawful processing and against accidental loss, destruction or damage

Bourne Community Radio is responsible for, and must be able to demonstrate, compliance with these principles.

Personal Data

Personal data is information relating to an identified or identifiable living individual.

An individual may be identifiable directly or indirectly, including through their name, identification number, location information, online identifier or other information relating to their identity.

Personal data can include both facts and opinions about an individual.

Processing of Personal Data

Bourne Community Radio must have an appropriate lawful basis before processing personal data.

Depending on the circumstances, lawful bases available under UK data protection law may include consent, contractual necessity, compliance with a legal obligation, protection of vital interests, legitimate interests and other lawful bases provided by legislation.

Consent is therefore not required for every processing activity.

Where Bourne Community Radio relies upon consent, that consent must meet the requirements of data protection legislation and individuals must be able to withdraw their consent.

Personal information will only be disclosed to third parties where there is an appropriate lawful basis for doing so.

Bourne Community Radio may process personal data for direct marketing and fundraising purposes where permitted by law. Individuals will be provided with appropriate rights to object or opt out, and such requests must be respected.

Electronic direct marketing must also comply with applicable Privacy and Electronic Communications Regulations (PECR) requirements.

Sensitive Personal Data

Bourne Community Radio may, from time to time, be required to process special category personal data.

Special category personal data includes information revealing or concerning:

Racial or ethnic origin
Political opinions
Religious or philosophical beliefs
Trade union membership
Genetic data
Biometric data used for the purpose of uniquely identifying a person
Health
A person's sex life
Sexual orientation

Processing special category data requires both an appropriate lawful basis under the UK GDPR and an applicable special category condition.

Information concerning criminal convictions, allegations and offences is subject to separate requirements under UK data protection legislation and is not classed as special category data.

Bourne Community Radio will ensure that any such information is only collected, accessed, retained and disclosed where appropriate and lawful.

Rights of Access to Information

Individuals have the right to request access to personal information held about them, subject to the provisions and exemptions of UK data protection legislation.

A person wishing to access their personal information may make a Subject Access Request to Bourne Community Radio.

Requests do not generally have to be made in writing and Bourne Community Radio should recognise a valid request regardless of how it is received.

Bourne Community Radio will respond without undue delay and normally within one month of receiving the request.

Where permitted by law, this period may be extended, including where a request is complex or where the individual has made multiple requests. The individual will be informed where an extension applies.

Where Bourne Community Radio reasonably requires further information to identify the information requested, the applicable statutory time period may be paused in accordance with current data protection legislation while that clarification is awaited.

Bourne Community Radio may also take reasonable steps to verify the identity of the person making a request where necessary.

Exemptions

Certain rights and obligations under data protection legislation are subject to exemptions in particular circumstances.

These may include circumstances involving:

Crime and taxation
Legal obligations
Regulatory functions
Legal proceedings and legal professional privilege
Safeguarding
The prevention or detection of crime
Other circumstances provided for by applicable legislation

Exemptions must not be applied automatically. Bourne Community Radio must consider whether a particular exemption applies to the specific circumstances and should document significant decisions where appropriate.

Further information should be sought from the Data Protection Officer/Data Protection Lead where necessary.

Accuracy

Bourne Community Radio will take reasonable steps to ensure that personal data it holds is accurate and, where necessary, kept up to date.

Individuals should notify Bourne Community Radio of relevant changes to information held about them.

Individuals have the right to request the rectification of inaccurate personal information and, in certain circumstances, completion of incomplete information.

Individuals may also have a right to request erasure of personal information in certain circumstances. The right to erasure is not absolute and information may sometimes need to be retained, including where there is a legal obligation or another lawful reason for doing so.

Enforcement

If an individual believes Bourne Community Radio has failed to comply with this Policy or applicable data protection legislation, they should raise their concern with the Data Protection Officer/Data Protection Lead or another appropriate member of the Management Committee.

Bourne Community Radio will maintain an appropriate process for receiving and dealing with data protection complaints.

In accordance with current legal requirements, complaints will be acknowledged within 30 days of receipt.

Bourne Community Radio will take appropriate steps to investigate a complaint and will inform the complainant of the outcome without undue delay.

Individuals also have the right to complain to the Information Commissioner's Office (ICO).

Data Security

Bourne Community Radio will take appropriate technical and organisational measures to ensure a level of security appropriate to the personal information being processed and the risks involved.

All members and volunteers who process personal information on behalf of Bourne Community Radio must respect the personal data and privacy of others.

Appropriate protection must be maintained against unlawful or unauthorised processing and against accidental loss, destruction or damage.

Personal data must be stored using appropriate systems and an appropriate level of security must be applied according to the nature of the information and processing being undertaken.

Access to personal information should be restricted to people who reasonably require access to perform their role.

Where appropriate, Bourne Community Radio should use measures including access controls, secure passwords, multi-factor authentication, secure backups, software updates and other reasonable security measures.

Other personal data may be intended for publication or limited publication within Bourne Community Radio and may therefore require different security measures.

Attention is also drawn to Bourne Community Radio's Security Policy and Email, Internet & Social Media Policy, where applicable.

External Processors

Bourne Community Radio must ensure that data processed by external processors, for example, service providers, Cloud services including storage, web sites etc. are compliant with this policy and the relevant legislation.

Secure Destruction

When data held in accordance with this policy is destroyed, it must be destroyed securely in accordance with best practice at the time of destruction.

Personal Data Breaches

Any member or volunteer who becomes aware of an actual or suspected loss, unauthorised disclosure, unauthorised access, alteration or destruction of personal information must report it to the appropriate person within Bourne Community Radio without undue delay.

Bourne Community Radio will investigate suspected personal data breaches and document breaches as required.

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, Bourne Community Radio will notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

Where a breach is likely to result in a high risk to affected individuals, Bourne Community Radio will also inform those individuals without undue delay unless an applicable exception applies.

Retention of Data

Bourne Community Radio may retain data for differing periods of time for different purposes as required by statute or best practices.

Other statutory obligations, legal processes and enquiries may also necessitate the retention of certain data. Bourne Community Radio may store some data such as registers, photographs, books and works including music scores etc. indefinitely in its archive.

17.22 Bourne Community Radio Privacy Notice for Members

This document provides a widely drafted privacy notice to allow data to be processed under a number of grounds and for a number of purposes.

Privacy Notice

How your information will be used

Bourne Community Radio needs to keep and process information about you for normal purposes. The information we hold and process will be used for our management and administrative use only and will be processed by authorised personnel only and confidentially stored. We will keep and use it to enable us to run the organisation and manage our relationship with you effectively, lawfully and appropriately, during the member recruitment process, whilst you are a member, at the time when you leave and after you have left. This includes using information to enable us to comply with any legal requirements, pursue the legitimate interests of the organisation and protect our legal position in the event of legal proceedings. If you do not provide this data, we may be unable in some circumstances to comply with our obligations and we will tell you about the implications of that decision.
As a local, independent community radio station broadcasting the best in music, entertainment and community updates, Bourne Community Radio may sometimes need to process your data to pursue our legitimate business interests. For example, to prevent fraud, administrative purposes or reporting potential crimes. The nature of our legitimate interests are to contact members in case of emergency; maintaining records of training provision; and maintaining data in relation to safeguarding children, young people & vulnerable adults for the purposes of the organisation. We will never process your data where these interests are overridden by your own interests.
Much of the information we hold will have been provided by you, but some may come from other internal sources, or in some cases, external sources, such as referees.
The sort of information we hold includes your application form and references; correspondence with or about you; contact and emergency contact details;; information needed for equal opportunities monitoring policy; information needed for disclosure and barring certificates and/or the DBS Update Service; and, where appropriate, disciplinary and grievance records.
Where necessary, we may keep information relating to your health, which could include allergies. This information will be used in order to comply with our health and safety and occupational health obligations – to consider how your health affects your ability to volunteer and whether any adjustments to support your volunteering might be appropriate.
Where we process special categories of information relating to your racial or ethnic origin, religious and philosophical beliefs or sexual orientation, we will always obtain your explicit consent to those activities unless this is not required by law or the information is required to protect your health in an emergency. Where we are processing data based on your consent, you have the right to withdraw that consent at any time.
Other than as mentioned below, we will only disclose information about you to third parties if we are legally obliged to do so.
We may transfer information about you to other group companies for purpose connected with the management of Bourne Community Radio’s business.
The criteria used for determining how long your data will be stored for is:
Application forms and interview notes (for unsuccessful volunteering candidates) – six months
Personnel files and training records (including disciplinary records and volunteering time records) - 6 years after volunteering ceases.
Management Committee records - permanently for historical purposes.
If in the future we intend to process your personal data for a purpose other than that which it was collected we will provide you with information on that purpose and any other relevant information.

Your rights

Under the General Data Protection Regulation (GDPR) and The Data Protection Act 2018 (DPA) you have a number of rights with regard to your personal data. You have the right to request from us access to and rectification or erasure of your personal data, the right to restrict processing, object to processing, as well as in certain circumstances, the right to data portability.
If you have provided consent for the processing of your data you have the right (in certain circumstances) to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn.
You have the right to lodge a complaint to the Information Commissioners’ Office if you believe that we have not complied with the requirements of the GDPR or DPA 2018 with regard to your personal data. Identity and contact details of Data Controller and Data Protection Officer.
Bourne Community Radio is the controller and processor of data for the purposes of the GDPR and DPA 2018.
If you have any concerns as to how your data is processed you can contact:

Adrian Smith - Data Controller
Shelley Spink - Data Protection Officer

Updated 27th January 2026